Skip to content
The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.
HTML Shell JavaScript Ruby Python
Branch: master
Clone or download
Latest commit 3bd078e Oct 16, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Create FUNDING.yml Jun 7, 2019
Checklists Updated version history Sep 11, 2019
Crackmes #1476: first set of dead links fixed Oct 6, 2019
Document-ja #1476: first set of dead links fixed Oct 6, 2019
Document-ru #1476: first set of dead links fixed Oct 6, 2019
Generated #1161: fixed gitignore Aug 5, 2019
Samples/Android Add files via upload Aug 10, 2018
Templates Removed remediation from the testcase template Jul 13, 2018
.gitattributes Re-add crackmes as regular files May 22, 2017
.markdownlinkcheck.json Fix urls May 14, 2019
.markdownlint.json #1398: added final missing pagebreaks Aug 4, 2019
.python-version Edit iOS Basic Testing Sep 9, 2017
.travis.yml #1204: updated PR feedback loop May 16, 2019 Release 1.1.3: last markdown sync and release Aug 4, 2019 Update Aug 22, 2019 Update Sep 16, 2019 Create Nov 6, 2018 updated with the new slack link Sep 26, 2019
book.json #1161: fixed gitignore Aug 5, 2019 Update Sep 12, 2019

OWASP Mobile Security Testing Guide Twitter Follow

Creative Commons License

OWASP Flagship Build Status

This is the official GitHub Repository of the OWASP Mobile Security Testing Guide (MSTG). The MSTG is a comprehensive manual for mobile app security testing and reverse engineering. It describes technical processes for verifying the controls listed in the OWASP Mobile Application Verification Standard (MASVS). You can also read the MSTG on Gitbook or download it as an e-book.

The MSTG and the MASVS are being adopted by many companies, standards, and various organizations. Want to find out more? Check our users document listing some of the adopters.



General Testing Guide

Android Testing Guide

iOS Testing Guide


Reading the Mobile Security Testing Guide

The release 1.0 of the MSTG was published in June 2018. You can get intermediate builds in multiple formats.

  1. Read it on Gitbook. The book is automatically synchronized with the main repo.

  2. Check the releases. Here you can find a PDF, an archive containing the sources and a DocX document for any given tagged version. Please note that the documents are generated automatically per tag.

  3. Get the book as printed version. A hardcopy of the book can be ordered via This version of the book is not completely aligned with book printing standards, but we are improving each version. If you recognize any issues or mistakes, even small ones, please raise an issue so we can fix it in the next version.

  4. Get the e-book. The book is available for free, but you can choose to purchase it at a price of your choosing if you wish to support our project. All funds raised through sales of the e-book go directly into the project budget and will be used to fund production of future releases.

  5. Clone the repository and run the document generator (requires pandoc). This produces docx and HTML files in the "Generated" subdirectory.

    $ git clone
    $ cd owasp-mstg/Tools/
    $ ./
  6. Clone the repository and run the gitbook generator. This produces PDF, Epub and Mobi files in the "Generated" subdirectory.

    $ git clone
    $ cd owasp-mstg/Tools/
    $ ./

You can also use the document index to navigate the master branch of the MSTG.

Contributions, feature requests and feedback

We are searching for additional authors, reviewers and editors. The best way to get started is to browse the existing content. Also, check the issues and the project page for a list of open tasks.

Drop a us line on the Slack channel before you start working on a topic. This helps us to keep track of what everyone is doing and prevent conflicts. You can create a Slack account here:

Before you start contributing, please check our contribution guide which should get you started.

Please note that the MSTG focuses primarely on the native apps. These are apps built with Java or Kotlin using the Android SDK for Android or built with Swift or Objective-C using the Apple SDKs for iOS. Nativescript/React-native/Xamarin/Cordova/... apps are not within the focus of the MSTG. However, some key-controls, such as pinning, have been explained already for some of these platforms. If you are looking for more security recommendations on this field, take a look the work-in-progress Google sheets based on the compliancy checklist 1.1.2:

If there's something you really want to see in the guide, or you want to suggest an improvement, create an issue issue or ping us on Slack. If the issue is accepted, we will schedule it into one of our milestones.

Authoring Credit

Contributors are added to the acknowledgements table based on their contributions logged by GitHub. The list of names is sorted by the number of lines added. Authors are categorized as follows:

  • Project Leader / Author: Manage development of the guide continuously and write a large amount of content.
  • Co-Author: Consistently contribute quality content, at least 2,000 additions logged.
  • Top Contributor: Consistently contribute quality content, at least 500 additions logged.
  • Contributor: Any form of contribution, at least 50 additions logged.
  • Mini-contributor: Everything below 50 additions, e.g. committing a single word or sentence.
  • Reviewer: People that haven't submitted their own pull requests, but have created issues or given useful feedback in other ways.

Please ping us or create a pull request if you are missing from the table or in the wrong column (note that we update the table frequently, but not in realtime).

If you are willing to write a large portion of the guide and help consistently drive the project forward, you can join as an author. Be aware that you'll be expected to invest lots of time over several months. Contact Sven Schleier (Slack: Sven), Jeroen Willemsen (Slack: jeroenwillemsen) or Carlos Holguera (Slack: Carlos) for more information.


In the Crackmes folder, you can find a set of mobile apps to hack. Are you able to find the secrets? For more details: check the at the Crackmes folder.

You can’t perform that action at this time.